Bug 135323

Summary:

[REGRESSION][ftlopt merge][32-bit] stress/prune-multi-put-by-offset-replace-or-transition-variant.js.dfg-eager hits an assertion in SpeculativeJIT::silentSavePlanForGPR

Product:

WebKit

Reporter:

Filip Pizlo <fpizlo>

Component:

JavaScriptCore

Assignee:

Filip Pizlo <fpizlo>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

ap, barraclough, ggaren, mark.lam, mhahnenberg, mmirman, msaboff, oliver, sam

Priority:

Version:

528+ (Nightly build)

Hardware:

All

OS:

All

Attachments:

Description	Flags
the patch	oliver: review+

Description Filip Pizlo 2014-07-26 10:02:20 PDT

Patch forthcoming.

Comment 1 Filip Pizlo 2014-07-26 10:07:01 PDT

Created attachment 235574 [details]
the patch

Comment 2 Filip Pizlo 2014-07-27 16:36:03 PDT

Landed in http://trac.webkit.org/changeset/171662

Comment 3 Mark Hahnenberg 2014-07-29 15:45:51 PDT

*** Bug 135025 has been marked as a duplicate of this bug. ***